191592 matches found
EUVD-2026-64678
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...
CVE-2026-78203
Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...
PT-2026-80809
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
PT-2026-81045
Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...
PT-2026-81008
Name of the Vulnerable Software and Affected Versions Dell ThinOS 10 versions prior to 2605 10.2518 Description An improper access control issue exists where a low privileged attacker with local access could potentially gain unauthorized access. Recommendations Update Dell ThinOS 10 to version 26...
PT-2026-80865
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...
PT-2026-80831
Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...
ROS-20260824-73-0001
The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...
PT-2026-80875
Name of the Vulnerable Software and Affected Versions HCL Hive Keycloak IAM Instance affected versions not specified Description Insufficient granularity of access control may allow an attacker to gain unauthorized access to resources. Recommendations At the moment, there is no information about ...
CVE-2025-68833: Use of a Cryptographic Primitive with a Risky Implementation
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
ROS-20260824-73-0002
The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...
PT-2026-80818
Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...
CVE-2026-28153: Missing Authorization
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...
CVE-2026-78266: Missing Authorization
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
PT-2026-80849
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...
PT-2026-80812
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
PT-2026-81117
Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...
CVE-2026-61419: Improper Access Control
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...